WCF Direct Authentication using BasicHttpBinding

Question

I am trying to test a simple scenario in my development machine wherein I have a service which is configured on basicHttpbinding. I am trying to use CustomUserNamePasswordValidator and have configured Security level as "TransportWithMessageCredential"

Now, when I test the service with a web client (both service and client on Asp.net development server), service completely ignores the validator and simply returns the data, although I am passing wrong credentials from my client.

Is it because I am using VS Development Server? Is use of SSL over HTTP manadatory when we use TransportWithMessageCredentials. Is there an alternative wherein I need not use Https?

Answer 1

WCF does not support any configurations out of the box which would permit transmission of unsecured credentials.